Skip to main content
CTI as a Code
Lab
Methodology
Training
Ecosystem
Intake Forms
Reactive Investigation
Proactive Assessment
Full-Cycle Program
Projects
CTI as a Code
CTI Analyst Field Manual
Customer-Driven AI CTI
Israel Threat Actors CTI
HexStrike AI
Medium
GitHub
All Projects
Full-Cycle CTI Program Intake
Reset
Print / Export PDF
Full-Cycle CTI Program Intake
Program name
Analyst
Commissioned by
Call time
1
Program mandate
1.1
What is the trigger for building this program?
Regulatory mandate (INCD, BoI, compliance directive) — ref:
Board / executive decision
Post-incident remediation
Maturity initiative / strategic investment
Other:
1.2
Who is the executive sponsor?
Name:
Role:
Authority:
1.3
New program or maturing an existing one?
New program — no structured CTI capability exists
Maturing — existing capability, extending scope or governance
Rebuilding — previous capability dismantled or failed
1.4
Target maturity level in 12 months?
Level 1 — Ad hoc (reactive only)
Level 2 — Defined (PIRs, source registry, basic products)
Level 3 — Managed (regular products, sharing established, metrics tracked)
Level 4 — Optimized (emulation, detection integration, regulatory compliant)
2
Stakeholders
2.1
Primary intelligence consumers?
Consumer
Role
Intelligence need
Cadence
TLP limit
RED
AMBER
GREEN
WHITE
RED
AMBER
GREEN
WHITE
RED
AMBER
GREEN
WHITE
RED
AMBER
GREEN
WHITE
2.2
Who has authority to approve and prioritize PIRs?
Name:
Role:
2.3
Who will be accountable for program metrics?
Name:
Role:
2.4
Who should NOT have visibility into the program's existence or findings?
Suspect insider, pending legal action, need-to-know restriction
3
Priority Intelligence Requirements
3.1
Top 3–5 questions the program must answer?
PIR
Stakeholder
Decision it drives
Review cadence
3.2
Any PIRs driven by a regulatory or compliance requirement?
Yes — PIR:
No
3.3
PIRs that cannot currently be answered (collection gap)?
4
Collection requirements
4.1
Internal sources available?
SIEM / security event logs
EDR telemetry
Incident history / IR reports
Vulnerability scan data
Cloud security logs (Azure AD / AWS CloudTrail / GCP)
Network flow data
OT / ICS telemetry
4.2
External sharing relationships currently in place?
CERT-IL
MOU active
In progress
None
Sector ISAC
Active
In progress
None
Commercial intel feed
Active
In progress
None
Peer-sharing group
Active
In progress
None
4.3
Top collection gaps?
Sources that would answer PIRs but are not yet available
4.4
Budget for new source subscriptions?
5
Sharing architecture
5.1
Intended external sharing partners?
Partner
Type
TLP limit
MOU needed?
Status
CERT-IL
National CERT
GREEN
Yes
RED
AMBER
GREEN
WHITE
Yes
No
RED
AMBER
GREEN
WHITE
Yes
No
RED
AMBER
GREEN
WHITE
Yes
No
5.2
Internal sharing requirements?
SOC, IR team, detection engineering, legal/compliance, executive
6
Team and resources
6.1
Analysts allocated to this program?
FTE:
Contractors / MSSP:
6.2
Tooling available?
OpenCTI (TIP)
TheHive (case management)
Cortex (enrichment)
Elastic SIEM / Kibana
Other:
6.3
Annual program budget?
6.4
Skills gaps requiring training, hiring, or contractor support?
7
Governance
7.1
Reporting structure?
Reports to:
Frequency:
7.2
Review cadence?
Weekly — tactical products, SOC alerts
Monthly — strategic products, stakeholder briefings
Quarterly — PIR review, program metrics, maturity assessment
Annual — charter review, budget justification
7.3
KPIs to measure program effectiveness?
e.g. PIR answer rate, detection coverage %, time-to-product, stakeholder satisfaction score
8
Regulatory context
8.1
Applicable compliance frameworks?
Framework
Applicable?
Key obligation
Deadline
INCD Directive
Yes
No
BoI-CD 362
Yes
No
GDPR
Yes
No
Yes
No
8.2
INCD MOU — status?
Active MOU in place
In progress — expected:
Not required
Required but not started
9
Analyst assessment
9.1
Current maturity level?
Level 1 — Ad hoc
Level 2 — Defined
Level 3 — Managed
Level 4 — Optimized
9.2
Top 3 program risks?
1.
2.
3.
9.3
Recommended first 30-day actions?
What must happen to establish credibility, answer at least one PIR, and demonstrate value?
10
Analyst notes
Free-form notes from the intake call — raw, unprocessed
11
Next actions
#
Action
Owner
Due
1
2
3
4